Stop other sites from framing your pages on WordPress

Why it matters

Without frame-ancestors or X-Frame-Options any site can load your pages in an invisible frame and trick visitors into clicking buttons they cannot see. One header tells browsers which sites, if any, may frame them.

The fix

1. WordPress sends X-Frame-Options only on the login and admin screens. For the front end, set the headers at the CDN or server (see their tabs), with a maintained security-headers plugin, or with the must-use plugin below.
2. The must-use plugin covers pages WordPress renders through PHP, not pages a cache serves without running PHP. The customizer preview frames the site from the same origin, which SAMEORIGIN allows.

<?php
/*
 * Plugin Name: Frame protection
 */
add_action( 'send_headers', function () {
	header( 'X-Frame-Options: SAMEORIGIN' );
	header( "Content-Security-Policy: frame-ancestors 'self'", false );
} );

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Clickjacking protection check
• Fix the X-Frame-Options value
• Limit frame-ancestors to sites you trust